ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Product

GraalVM

1 mentions in 7 days · 1 in 30 days · 1 total · first seen · last

Search everything

Timeline

Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild

Unauthenticated RCE CVE-2026-58138 in Orkes Conductor is actively exploited; Fortinet blocked ~7,000 attacks; patch to 3.30.2.

Fortinet reports active in-the-wild exploitation of CVE-2026-58138 (CVSS v3.1 9.8), an unauthenticated remote code execution flaw in Orkes Conductor 3.21.21 before 3.30.2. Attackers submit inline workflow definitions with malicious JavaScript or Python expressions to the workflow API, escaping unsandboxed GraalVM evaluators configured with HostAccess.ALL to run arbitrary OS commands. Fortinet blocked 1,290 attempts in 24 hours as of September 9, 2026, and nearly 7,000 between September 2-9, with most activity from Germany, Hong Kong, Indonesia, the U.A.E., and India. Previdian and Empirical Security also observed exploitation since July 24, 2026.

The Hacker News · 19h agoExploit / PoC in the wild 2 sourcesCVE-2026-581381· 1 read

Related CVEs

  • CVE-2026-581389.39%
    Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS comma
    Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Java reflection or direct subprocess calls.
    —

Appears with

organization Empirical Security 1organization Fortinet 1organization Previdian 1product Orkes Conductor 1vendor Fortinet 1vendor Orkes 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.